﻿
// 19MFCSpyDlg.cpp: 实现文件
//

#include "pch.h"
#include "framework.h"
#include "19MFCSpy.h"
#include "19MFCSpyDlg.h"
#include "afxdialogex.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#endif


// 用于应用程序“关于”菜单项的 CAboutDlg 对话框

class CAboutDlg : public CDialogEx
{
public:
	CAboutDlg();

// 对话框数据
#ifdef AFX_DESIGN_TIME
	enum { IDD = IDD_ABOUTBOX };
#endif

	protected:
	virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV 支持

// 实现
protected:
	DECLARE_MESSAGE_MAP()
};

CAboutDlg::CAboutDlg() : CDialogEx(IDD_ABOUTBOX)
{
}

void CAboutDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialogEx::DoDataExchange(pDX);
}

BEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx)
END_MESSAGE_MAP()


// CMy19MFCSpyDlg 对话框



CMy19MFCSpyDlg::CMy19MFCSpyDlg(CWnd* pParent /*=nullptr*/)
	: CDialogEx(IDD_MY19MFCSPY_DIALOG, pParent)
{
	m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
}

void CMy19MFCSpyDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialogEx::DoDataExchange(pDX);
	DDX_Control(pDX, IDC_PICTURECTRL, m_pictureCtrl);
}

BEGIN_MESSAGE_MAP(CMy19MFCSpyDlg, CDialogEx)
	ON_WM_SYSCOMMAND()
	ON_WM_PAINT()
	ON_WM_QUERYDRAGICON()
	ON_BN_CLICKED(BTN_SPY, &CMy19MFCSpyDlg::OnBnClickedSpy)
END_MESSAGE_MAP()


// CMy19MFCSpyDlg 消息处理程序

BOOL CMy19MFCSpyDlg::OnInitDialog()
{
	CDialogEx::OnInitDialog();

	// 将“关于...”菜单项添加到系统菜单中。

	// IDM_ABOUTBOX 必须在系统命令范围内。
	ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);
	ASSERT(IDM_ABOUTBOX < 0xF000);

	CMenu* pSysMenu = GetSystemMenu(FALSE);
	if (pSysMenu != nullptr)
	{
		BOOL bNameValid;
		CString strAboutMenu;
		bNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);
		ASSERT(bNameValid);
		if (!strAboutMenu.IsEmpty())
		{
			pSysMenu->AppendMenu(MF_SEPARATOR);
			pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
		}
	}

	// 设置此对话框的图标。  当应用程序主窗口不是对话框时，框架将自动
	//  执行此操作
	SetIcon(m_hIcon, TRUE);			// 设置大图标
	SetIcon(m_hIcon, FALSE);		// 设置小图标

	// TODO: 在此添加额外的初始化代码

	return TRUE;  // 除非将焦点设置到控件，否则返回 TRUE
}

void CMy19MFCSpyDlg::OnSysCommand(UINT nID, LPARAM lParam)
{
	if ((nID & 0xFFF0) == IDM_ABOUTBOX)
	{
		CAboutDlg dlgAbout;
		dlgAbout.DoModal();
	}
	else
	{
		CDialogEx::OnSysCommand(nID, lParam);
	}
}

// 如果向对话框添加最小化按钮，则需要下面的代码
//  来绘制该图标。  对于使用文档/视图模型的 MFC 应用程序，
//  这将由框架自动完成。

void CMy19MFCSpyDlg::OnPaint()
{
	if (IsIconic())
	{
		CPaintDC dc(this); // 用于绘制的设备上下文

		SendMessage(WM_ICONERASEBKGND, reinterpret_cast<WPARAM>(dc.GetSafeHdc()), 0);

		// 使图标在工作区矩形中居中
		int cxIcon = GetSystemMetrics(SM_CXICON);
		int cyIcon = GetSystemMetrics(SM_CYICON);
		CRect rect;
		GetClientRect(&rect);
		int x = (rect.Width() - cxIcon + 1) / 2;
		int y = (rect.Height() - cyIcon + 1) / 2;

		// 绘制图标
		dc.DrawIcon(x, y, m_hIcon);
	}
	else
	{
		CDialogEx::OnPaint();
	}
}

//当用户拖动最小化窗口时系统调用此函数取得光标
//显示。
HCURSOR CMy19MFCSpyDlg::OnQueryDragIcon()
{
	return static_cast<HCURSOR>(m_hIcon);
}


#include "..\\19MFCSpyDll\\19MFCSpyDll.h"
#pragma comment(lib, "..\\19MFCSpyDll\\debug\\19MFCSpyDll.lib")

void CMy19MFCSpyDlg::OnBnClickedSpy()
{
	// 重置文本框显示缓冲区，在19MFCSpyDll中定义的共享数据
	g_szBuffMFCSpyData[0] = '\0';	// 
	
	// 获取目标进程的窗口句柄
	CString csHWndText;
	GetDlgItemText(IDC_EDIT_SPYFIND_HANDLE, csHWndText);
	HWND hWndDst = NULL;
	_stscanf_s(csHWndText.GetBuffer(), _T("%08X"), &hWndDst);

	// 判断是不是MFC窗口
	if (!::SendMessage(hWndDst, WM_QUERYAFXWNDPROC, 0, 0))
	{
		AfxMessageBox("Not MFC Window");
		return;
	}


	// 远程注入dll到目标进程
	//1. 获取PID
	DWORD dwProcessID = 0;
	::GetWindowThreadProcessId(hWndDst, &dwProcessID);
	if (dwProcessID != 0)
	{
		HANDLE hProcess = NULL;
		hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID);
		if (hProcess != NULL)
		{
			//2. 获取LoadLibrary地址
			HMODULE hModKernel32 = GetModuleHandle("kernel32.dll");
			FARPROC pfnLoadLibrary = GetProcAddress(hModKernel32, "LoadLibraryA");

			//3. 获取dll路径并写入到目标进程中
			HMODULE hModSpyDll = GetModuleHandle("19MFCSpyDll.dll");
			char szDllPath[MAX_PATH];
			GetModuleFileName(hModSpyDll, szDllPath, MAX_PATH);
			LPVOID pszDllPathBuff = NULL;
			pszDllPathBuff = VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
			if (pszDllPathBuff != NULL)
			{
				BOOL bRet = WriteProcessMemory(hProcess, pszDllPathBuff, szDllPath, strlen(szDllPath) + 1, NULL);

				//4. 设置进程间同步事件
				HANDLE hEvent = CreateEvent(NULL, TRUE, FALSE, "19MFCSpy");
				if (hEvent != NULL)
				{
					//5. 创建远程线程
					g_hMFCWndSelected = hWndDst;	// 设置当前选择的窗口，在19MFCSpyDll中定义的共享数据
					HANDLE hThreadLoad = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pfnLoadLibrary, pszDllPathBuff, 0, NULL);
					if (hThreadLoad != NULL)
					{
						WaitForSingleObject(hThreadLoad, 1000);
						//给目标窗口发个消息，要不然AfxWndProc主线程不运行，我们的dll中的代码就不会跑，就会一直卡在这里
						::SendMessage(hWndDst, WM_NULL, 0, 0);

						//6. 同步等待dll调用成功后，显示结果
						WaitForSingleObject(hEvent, INFINITE);
						if (strlen(g_szBuffMFCSpyData) > 0)
						{
							SetDlgItemText(EDT_SHOW, g_szBuffMFCSpyData);
						}
						else
						{
							SetDlgItemText(EDT_SHOW, "Not Found");
						}

						//7. 卸载目标进程中的19MFCSpyDll，用户如果重复spy一个窗口，就可以重新注入并调用dllmain中的SetWindowLong替换目标进程的AfxWndProc
						//调用GetModuleHandleA获取目标进程中注入的模块
						DWORD dwHModuleSpyDll;
						FARPROC pfnGetModuleHandle = GetProcAddress(hModKernel32, "GetModuleHandleA");
						HANDLE hThreadGetHMod = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pfnGetModuleHandle, pszDllPathBuff, 0, NULL);
						WaitForSingleObject(hThreadGetHMod, INFINITE);
						GetExitCodeThread(hThreadGetHMod, &dwHModuleSpyDll);

						//调用FreeLibrary卸载注入的dll
						FARPROC pfnFreeLibrary = GetProcAddress(hModKernel32, "FreeLibrary");
						HANDLE hThreadFreee = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pfnFreeLibrary, (LPVOID)dwHModuleSpyDll, 0, NULL);
						WaitForSingleObject(hThreadFreee, INFINITE);

						CloseHandle(hThreadFreee);
						CloseHandle(hThreadGetHMod);
						CloseHandle(hThreadLoad);
					}
					CloseHandle(hEvent);
				}
				VirtualFreeEx(hProcess, pszDllPathBuff, 0, MEM_RELEASE);
			}
			CloseHandle(hProcess);
		}

	}


}
